-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Grant Taylor wrote:
> On 6/14/22 3:33 AM, Dan Purgert wrote:
>> Which "vendor" are you thinking of here? Cisco/Aruba/Juniper?
>> They totally can do DNAT over the CGNAT range.
>
> I was mostly focusing on "lack of willingness" more than "capability".
>
> Your response to my previous email make me think you probably fall into
> the "lack of willingness" group.

It's a mix of both -- remember that the "small carrier" who is forced
into using CGNAT may only have a /28's worth of actual public IPv4
addresses for their customers to share. Maybe even less.

Things get messy when you've got multiple households hitting the
internet from the same public IP address.

>> [...]
>> Of course. Or they could pressure their provider for v6, and be
>> "on the internet" that way (IME with various WISPs, that's their M.O.)
>
> Except IPv6 is not the same as IPv4. It's not even really feature
> parity. It's definitely not the same set of endpoints.

What, exactly, do you mean here by "same set of endpoints" ?

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE3asj+xn6fYUcweBnbWVw5UznKGAFAmKprQUACgkQbWVw5Uzn
KGBPqQ/9GKBYNM4brn0PZI70A+cxLbAqN3PshDCuXT/A6SJWeEdYfJMThiZ8y0J6
3uZZ0JWh7jFNaHt+MrCDDjq9e612lbabUSG16R3t+pZnEONGPWqI1xnt+WzWghEB
oIjN967qmuE+02rGm+PkqGOqcN6N7Cxd5igdN4mb6YOj3E8BhIfa2MF8EsgB2TEx
s/JqNkV+iECKnUU+gDhk1jvyfqfcE4xC02WhZJvsToF+jEAxjueulLs7o/ZsJF0b
YeKw4Wg6uVbv7ken70W8JZrpooFkppPI2+XdavUpIW1pRBsiCpbk/pHVQk9ALN2h
98ur9AnGd6Zn7F8AzrYS5EOEkv6o3Vl8UJ10zhPgBFOGP1VHLlUxw15CZKft6Tjt
q3khEXb7REzD2a0sHETqOKnJHK7KNmPHg6EAr2KsAdQHi5KLE82LJYSO7KsvY7p/
Aq1D8kJUiMnqQfnsnVNpdBpN4vZmLMe7MVOcQFsRmqZ0WL5RFrsQOXTZfuUxoavK
9uk0q1JnwWZ7SU6e/m8+uAKIeowa9deO/z5zLvHSCsrkW4b6IxNQ1xumNd1Wuq4R
g+DnKz0TloMvvPVDF8iYwLQgNoJZlFC1ku8QbpdwYnc5rcllZ3M/E8QW4UmBvzXj
FmIHlh1dBy4VYmuKhENTVxzUYeLKbaD4fXmBd5N3Wt0I3bMr6MY=
=K3V9
-----END PGP SIGNATURE-----

--
|_|O|_|
|_|_|O| Github: https://github.com/dpurgert
|O|O|O| PGP: DDAB 23FB 19FA 7D85 1CC1 E067 6D65 70E5 4CE7 2860

On 6/15/22 3:40 AM, Dan Purgert wrote:
> I suppose it depends on the carrier, and the setup / future plans.

Yep.

> The ones I've worked with are pretty universally "no", outside of the
> reserved / business accounts (as would I be, if I lived somewhere where
> I could actually compete as a carrier).

That's been my experience too.

Though said reserved / business accounts tend to be one or more levels
up from residential access to the Internet (atti) and are instead native
be on the Internet (boti). As such, forwarding via CGNAT isn't an issue
because CGNAT isn't in play.

> Long story short is that they have NAT pools from their CGN-space
> to the public internet, in order to avoid issues where popular
> websites/services will reject the customer for "too many
> connections". That being said, they do offer ipv6 options.

ACK

--
Grant. . . .
unix || die

On 6/15/22 3:57 AM, Dan Purgert wrote:
> It's a mix of both -- remember that the "small carrier" who is forced
> into using CGNAT may only have a /28's worth of actual public IPv4
> addresses for their customers to share. Maybe even less.

I am surprised by the carrier only having a /28. I was naively thinking
that just about all small ISPs would have at least one /24 and be
participating in BGP with one (or more) upstream providers.

The /28 with it's own default gateway makes me think of something like
an individual providing / reselling access to neighbors and / or hotels
/ businesses using a /28 for their use and guest internet access.

I'm inclined to stick with the /24+BGP as the smallest end of a
traditional ISP.

> Things get messy when you've got multiple households hitting the
> internet from the same public IP address.

I'm well aware.

> What, exactly, do you mean here by "same set of endpoints" ?

Think about the Venn diagram of the overlap of IPv4 and / or IPv6
connectivity. You have different sets of endpoints (clients / servers)
in the IPv4 and IPv6 circles, plus the overlap in the middle. IPv4
/only/ endpoints can't talk to IPv6 /only/ endpoints.

Aside: I consider middle boxes that do protocol translation as negating
the /only/ aspect because they make the /only/ become a pseudo dual
protocol.

--
Grant. . . .
unix || die

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Grant Taylor wrote:
> On 6/15/22 3:57 AM, Dan Purgert wrote:
>> It's a mix of both -- remember that the "small carrier" who is forced
>> into using CGNAT may only have a /28's worth of actual public IPv4
>> addresses for their customers to share. Maybe even less.
>
> I am surprised by the carrier only having a /28. I was naively thinking
> that just about all small ISPs would have at least one /24 and be
> participating in BGP with one (or more) upstream providers.

Yeah, but /24s are hard to come by, and not cheap -- about $55 per
address, and (at least in the US) require proof you need it/will
actually utilize it in the coming year (or something to that effect) --
so not something a startup / small WISP can necessarily get.

So, they get a contract with a transit carrier, who hands off a slice of
something they own. I mean, you gotta start somewhere ...

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE3asj+xn6fYUcweBnbWVw5UznKGAFAmKq970ACgkQbWVw5Uzn
KGClpg//XGz42u0aYxK/gLDfpfJ6jAoeQ9fvNyWhvGQ3/MJZyRiUO0qySmDtw3oS
0D89Up+a/g21Hw9eSsEyRScGmKMN9AT+krl65HYPQRtGm1X50zBxPfXYm88eJZpR
QRZHxhybdBGQKIuONhKQ3ZBLUT8eROkZc/uF0pi6aGblzc0MnTJD+L4uBYvLoXxs
1pfqLYiX7pbHpruQN6FK/5nmJCqiW4u1uPMxnqWuUwCwWwwWCwqyBdQTcz008hMy
Kw1ZT4VQaeF3Nh3WA14cJLpaUuBc+aQpwGkKWcP3x79sWyjKkQ4H26vsvvNWJ/Rs
JqdxqO+jWeJoYFLVMnoj3CklK4Dqim2Vk/68IUeidhlRxeKM1c/GA2JSGvzMKpOj
/d4tg8YsoPL3mdQwUQY1s9CQ96VjCEieed7HhJMmn5dOtrLoJkb45Kt0h4xVv9fn
iP47XSCpgtErUmv9PwiswifxBwFcdQ7WnVbNXOhKqRLuqMcW9W9IFMNcMuk0Iwb1
FH4Cn9bbFPpctFs1IAbFCEnDm9x91ErOgnzK7/+uYJCoUGEFsiay16RYXcsKZWBn
vgVWspraKdEnX8vdyFcRq34WHMsvlRFnulc7JiUQRz3/lAaK1OrLKXsvdFZ0lR7d
qvLSVpKpZeDoWZJfb97NkdvCYk7/sktx3cm8tmbJAYPCBOfNKSg=
=QB7i
-----END PGP SIGNATURE-----

--
|_|O|_|
|_|_|O| Github: https://github.com/dpurgert
|O|O|O| PGP: DDAB 23FB 19FA 7D85 1CC1 E067 6D65 70E5 4CE7 2860

On 6/16/22 3:28 AM, Dan Purgert wrote:
> So, they get a contract with a transit carrier, who hands off a slice
> of something they own. I mean, you gotta start somewhere ...

Agreed.

I just hadn't considered an ISP operating with less than a /24.

--
Grant. . . .
unix || die

On 2022-06-13, Marco Moock <mo01@posteo.de> wrote:
> Is is a problem of NAT itself. SIP isn't intended to run behind
> NAT/CG-NAT.

SIP is a pretty obnoxious protocol for many reasons other than its
inability to work behind CGNAT (not that I'm excusing CGNAT.) SDP
negotiation is challenging, ICE takes a really long time (though I
guess you're mostly using ICE for NAT hole-punching), and UDP RDP
streams suffer all sorts of issues. SIP ALG has been implemented
buggily by pretty much every consumer router manufacturer and VoIP
providers will send SIP over TLS just to stop ALG for mucking with
addresses. Ask me about the time I ran into MTU issues with UDP RDP
and how I debugged it. Ugh.

I wish these complicated VC stacks could just be replaced by a QUIC
based protocol with in-band data already. There's a reason why so many
livestreaming services these days go with RTMP instead of SIP despite
RTMP being an "ancient" protocol.